Financials ISAC Japan Management Regulations

The Board of Directors pursuant to Article 31.2 of Financials ISAC
Japan Articles of Incorporation has set forth these generalmanagement regulations.
Chapter 1 General Provisions
Article 1 (Purpose)
1
Financials ISAC Japan (hereinafter “ISAC”) has been
established for the purpose of ensure continuing faithin our financial institutions through information
security activities for Japanese citizens, and sharing
and analysis of information concerning information andphysical security in order to further improve thereliability of Japanese financial institutions.
2In order to achieve the purpose stated in the preceding
paragraph, all the members of ISAC participate incooperation on sharing and analysis of relevant
information, which in turn leads to enhanced
information
securitythus
ensuring
security
improvement in the financial market as a whole.
Article 2 (Definitions)
Within these regulations the terms stated below shallhave the following meanings.
(1) Member:legal entities or individuals thatare presently participants of ISAC.
(2) Member Activities:
Activities conductedby members through the membership activities’
foundation offered by ISAC.
(3) Information Sharing:
Whenintheperformance of member activities, a member
provides information with ISAC and itsmembers, which may be shared or individuallyused by a recipient member.
Suchinformation includes information produced
through member activities.
(4) Sender: Provider of relevant information for ISAC
and its members.
(5) Recipient:
Recipient of information provided
through ISAC activities.
Chapter 2 Members
Article 3 (Membership Categories)
1
Members shall be those legal entities or individuals
that agree with the above stated purpose of ISAC andare willing to support and contribute to ISAC activities.
2
ISAC shall establish the categories of full members,
trial members, affiliate members and supporting
members. For details of membership categories, referto the appendix.
Article 4 (Application Method)1
Any party that desires to become a member of ISAC,
after submission of a completed application form andupon review and approval by the Board of Directors,
may become a member.
2
Where the Board of Directors deems that a party’s
application does not meet the standards required formembership or where other legitimate reasons apply,
the Board of Directors may deny membership to ISAC.
Article 5 (Change to Membership Category)
Full members and trial members may, after becoming
members and upon submission of the required
application form to the Board of Directors and theBoard of Directors approval, change their membershipcategory.
Article 6 (Scope of Membership)
Legal entities eligible to be a member of ISAC shall belimited to those entities recognized under law.
Article 7 (Succession of Standing)
1
Where due to merger, etc. a member’s standing has
been assigned or transferred, that member shallprovide proof in writing verifying the succession of its
standing, and promptly submit the application form
designated by ISAC.
2
Where upon succession of standing the Board ofDirectors deems that a party’s application does notmeet the standards required for membership or whereother legitimate reasons apply, the Board may deny thesuccession of member’s standing.
Article 8 (Prohibition against Transfer of Rights)
A member may not transfer membership rights to any
third party.
Chapter 3 Annual Membership Fees
Article 9 (Annual Membership Fees)
1
A member shall pay to ISAC for each financial year of
ISAC the annual membership fees set forth in theattachment in accordance with the payment method
stipulated by ISAC in the application form, etc.
2
Even where a party becomes a member during thefinancial year of ISAC, no discount shall be made to theannual membership fees.
3
Where a member upgrades its category, that member
shall pay to ISAC the difference in annual membershipfees resulting from that upgrade. In the event of adowngrade in membership category, ISAC shall notreimburse that member for any difference inmembership fees already paid.
4
Under no circumstances shall ISAC reimburse to any
member any membership fees already paid.
Chapter 4 Withdrawal from Membership
Article 10 (Voluntary Withdrawal)
A member, upon submission of a request to ISAC on
ISAC’s designated withdrawal request form as
designated by the Board of Directors, may at any time
withdraw from membership of ISAC.
Article 11 (Membership Expulsion or Suspension of Participationin Member Activities)
1
Where any one(1) of the following items applies to amember, upon resolution at a general meeting ofmembers that member shall be expelled.
(1) Where a member is in breach of the Articles ofIncorporation, regulations or any resolution passed ata general meeting of members.
(2) Where a member has engaged in any act that damages
the reputation of ISAC or that is contrary to thepurpose for which ISAC was established.
(3) Where any other legitimate reasons exist under which
ISAC may expel the member.
2
Where the Board of Directors has deemed that anyone(1) of the above items applies to a member, ISAC
may immediately suspend that member’s participation
in member activities.
Article 12 (Forfeiture of Membership Rights)

In addition to those stipulations stated in the preceding
two Articles, where any one(1) of the following items
applies to a member, that member shall forfeit its
membership rights.
(1) Where a member has failed to make payment forone(1) year or more of its membership fees.
(2) Where forfeiture has been decided based upon aresolution at a general meeting of members.
(3) Where a member is a person and that person has died,or has been officially notified as missing, or themember with corporate status has been dissolved.
(4) Where a member is a person and that person has
been deemed to be a ward of the state or person undercuratorship.
(5) Where it is deemed by ISAC that member’s status
should be revoked.
Chapter 5 ISAC Management
Article 13 (Board of Directors)
1
The Board of Directors of ISAC shall as required
perform its duties as stipulated under Article 31 of
ISAC’s Articles of Incorporation.
2
Details concerning the management of the Board ofDirectors shall be as separately set forth in the Boardof Directors Management Regulations.
Article 14 (Steering Committee)
1
The Steering Committee of ISAC shall, upon receiving
an inquiry from the Board of Directors in respect ofISAC’s administration or ISAC’s member activities,
consult and offer advice to the Board of Directors.
2The Steering Committee shall be comprised of members
selected by the Board members or Board of Directors
from among the full members.
3
Details of the management of the Steering Committee
shall be as separately set forth in the Steering
Committee Management Regulations as approved by
the Board of Directors.
Article 15 (Secretariat Office)1
Within ISAC a Secretariat Office shall be establishedto perform management of member activities andrelated administrative duties.
2
ISAC may outsource all or any part of the Secretariat
Office’s duties to a third party.
3
ISAC, limited to where it has commissioned Secretariat
Office duties to a third party, may without processing
provide information shared by any member to thatthird party. However in that event the prior consent of
the Board of Directors or a member of the board shallbe obtained, and the Board ensure appropriate
oversight of that third party.
4
Details concerning the management of the Secretariat
Office shall be as separately set forth in the Secretariat
Office Management Regulations.
Chapter 6 Information Sharing and Use
Article 16 (General Rules concerning Information Sharing andUse)
1
ISAC and its members in accordance with the purpose
for which ISAC has been established shall promote
information sharing.
2
Where sharing information, ISAC and its members
shall strictly comply with the following rules.
(1) They shall act in compliance with the Copyright Act
and all other applicable laws, regulations andordinances, and not hinder or interfere with therights of ISAC or any member.
(2) ISAC and its members shall promote information
sharing.

(3) The sender permits the use by ISAC or its membersof the information provided it is solely for achieving
the purpose of ISAC.
(4) Any recipient assumes full responsibility for use of
any information provided by the sender and shallin no way hold the sender liable for any damages
arising from that sent information.
(5) The user of the sent information shall strictly
comply with the provisions of the next Article andany other use conditions set forth by the sender at
the time of provision.
3
Details concerning the sharing of information shall be
as separately set forth in the Information Sharing
Rules.
Article 17 (Confidentiality: Traffic Light Protocol）
1
Members that engage in information sharing, in order
to indicate the information’s categorization and thescope of disclosure permission, shall act in accordancewith the Traffic Light Protocol (hereinafter referred toas “TLP”).
2
The member that is a sender, in accordance with TLP,
shall agree to ISAC or its other members using thatinformation.
3
ISAC or its members when using the shared
information shall strictly comply with the published
TLP.
4
Directors, the Secretariat Office and the Steering
Committee, regardless of classification under TLP may
access information provided by the sender.
Article 18 (Disclosure of Information as Required under Law)
ISAC or its members, where disclosure is required
under law, upon receipt of a demand requiring
disclosure by a competent public authority, may within
the scope of that demand disclose the shared
information.
Article 19 (Obligation to Notify)
1
Except where the preceding Article applies, ISAC or its
members, limited to where the prior approval of thesender has been obtained, may disclose the shared
information outside the scope designated in TLP.
2
The member that has sent that information may
prohibit its disclosure where that disclosure is inbreach of the preceding paragraph.
Article 20 (Provision of Information to Commissioned or other
Third Parties)
ISAC or its members, in the use of the shared
information and in order to maintain its security whenproviding it to any commissioned party or any otherthird party, shall only provide it upon appropriate
processing so that the sender is not able to be directly
or indirectly identified by the commissioned or otherthird party.
Chapter 7 Compensation for Damages
Article 21 (Liability Exclusion)
1
ISAC or its members offer no guarantees or warrantiesconcerning the accuracy of any shared information.
2
ISAC or its members shall assume no legal liability
arising as a result from any loss or damage incurred asa result of the shared information. However thepreceding sentence shall not apply in respect of grossnegligence or intentional acts.
Article 22 (Gross Negligence or Intentional Acts)
1
Where due to the gross negligence or intentional act ofa member there is a breach concerning information
sharing or its use, or where other damages are suffered
as a result of that gross negligence or intentional act,
based upon mediation by a Board member(s) the2providing member and the using member shall settle
that dispute.
Where due to the gross negligence or intentional act of
ISAC there is a breach concerning information sharing
or its use, or where other damages are suffered, limited
to the amount of annual membership fees, ISAC shall
pay compensation for damages to any concernedmember.

Chapter 8 Supplementary
Article 23 (Representations and Warranties)
ISAC and its members do hereby affirm and warrant
that they are not a criminal organization and has noaffiliation with any organization engaged in anti-socialactivities, that it in no way cooperates with orcontributes to the management or operation of thoseorganizations and further does not receive any fundingor support from those organizations.
Article 24 (Governing Law and Consent to Jurisdiction)
ISAC and its members do hereby agree that where any
dispute arises concerning membership creation,
enforcement or validity, the performance orinterpretation of these Management Regulations thatsaid dispute shall be governed by the laws of Japan andthat in the event that any claim is made in respect of ause agreement that the Tokyo District Court shall be
the court of primary and exclusive jurisdiction.
Article 25 (Force and Effect)
1
These Management Regulations represent thecomplete agreement between ISAC and its members
concerning membership qualification and member
activities, and shall take precedence over all otherrepresentations, negotiations, communications or othernotifications made prior to membership.
2
Where for whatever reason a member has been expelled
or withdrawn from membership, in respect of thatmember, Articles 16, 17, 18, 19, 20, 21 and 22 shallremain in force and effect.

Enacted: August 29, 2014
General Incorporated Association Financials ISAC Japan≪Revision History≫
March 15, 2016
Added affiliate member category.
July 1, 2018
Changed TLP operation.
August 8, 2018
Changed membership categories
February 9, 2023
Changed TLPEnd（Attachment）Membership Category

Membership Category

Qualification
1forMembership(*1)

2

Application
Method

Full

Trial

Supporting

membersmembersmembers

Gold

SilverBronze

A legalA legalA legalentity except

entity except

entity except

A financial

A financial

A company orfor afor afor a

institution

institution

person thatfinancial

financialfinancialtradingtrading

supports theinstitution

institution

institution

withinwithinactivities of(Companies,(Companies,(Companies,JapanJapan

ISAC

etc. involved

etc. involved

etc. involved

in IT

in IT

in ITsecurity)

security)

security)

Application

Application

Applicationfrom member

from member

from member

Application

Application

Upon

from

from

invitation bymember

memberISAC

Annual

800,000 yen

3 Membership(Non-Fees (*2)

taxable)Appointment
4 as a Board

Affiliate members

Possible

Member3,000,000
Free ofcharge－yen

2,000,000 yen 1,000,000 yen(Non-(Non-taxable) (Non-taxable)

taxable)NotPossible

Possible

Not Possible

Not Possible

Not Possible

Possible

Not Possible

Not Possible

Not Possible

Appointment
as a Member
5 of theSteering

Possible

NotPossible

Committee*1

For details, refer to the membership standards as separately set forth.

*2

Annual membership fees may change based upon a resolution at a general meeting ofmembers.

（Attachment）Traffic Light Protocol

Members where sharing information as a part of member activities shall act in accordancewith the Traffic Light Protocol (hereinafter referred to as “TLP”) stated below, and may
request that the recipient (member or ISAC) handle that information in an appropriatemanner. Upon information sharing where the category is not clearly stated within the TLP
that information shall be categorized as “Amber”.
TLP

Regulation

Explanation

Category
・For the eyes and ears of individual recipients

Information
Redisstrictly only, no further disclosure.

limited to those presentat the meeting.

・ Recipients

may

not

share

TLP:RED

information with anyone else.
・Therefore, TLP:RED information doesn’t exist
on the SIGNAL.
・ Information sharing to other parties notpermitted.

(Includes

intra-departmental

sharing)Information to be kept ・ As this is a category that makes effective
within the specific group
Amber+STRICT(meeting attendees, etc.)

information utilization difficult, the following
efforts should be made.

✓ Indicators, etc. should be separately

to whom that information

shared under a different category such as

was shared, disclosure

Amber, etc.

outsidethatspecified✓ Where provided that the sender’s name isdeleted this is able to be shared to thegroup not permitted.

minimum scope possible, this should bestated.
✓ Where due to the passage of time sharing
is now possible, this should be announced.
*In order to protect members’ systems andInformation sharing torequired
Amberservices, sharing of only necessary information torequired recipients is permitted.

recipients (Use for any other purposes than stated above iswithin the scope that not permitted.)
confidentiality

canbe ・Even where the ISAC Secretariat Office is tomaintained is permitted.

share

information

withotheraffiliatedorganizations, that should be limited to sharingof only necessary information to required

recipients.
・Where information is to be otherwise shared,after deleting the name of the sender, etc. itshould be limited to sharing of only necessary
information to required recipients. Unprocessed
information should not be forwarded.
・Where information is to be otherwise shared,

Green

Information sharing to after deleting the name of the sender, etc. it
required recipients is should be limited to sharing of only necessary
information to required recipients. Unprocessedpermitted.

information should not be forwarded.

Handling

aspublicinformation.
*In compliance with theClear

Copyright Act and allotherapplicableregulations

laws,A member company may share thisinformation within a reasonable scope.

andordinances.
*This includes a consolidated group subsidiary in which a member holds more than 51% of
its equity. However, where a group subsidiary that is deemed to be of a designated scale
to which the separately stated standards apply desires to become a member, it must
make an application separate from its parent company. Further a member groupsubsidiary as a general rule may not directly participate in member activities.
Information must only be used to protect the systems and services of each member. In
respect of information sharing with organizations not affiliated to ISAC, or the secondary
application of products or services based upon shared information, where the permissionof the original information sender has not been obtained, as a general rule this shall notbe permitted.
Where information is to be provided to an outsourced party, Article 20 of theseRegulations shall apply.

Financials ISAC Japan Management Regulations (Supplementary Regulations)

Article 26 (As a footnote to the “(Attachment) Traffic Light Protocol” within these Management Regulations,the criteria for a subsidiary which must make an application separate from its parent company)
1 For organizations to which the items stated in the table below apply, even where a parent company isa member, information sharing from the parent company shall not be included in the applicable scope,and in order to participate in the information sharing activities of ISAC, the subsidiary itself is required
to be a member.
Reference
Total Assets

Total Sales

Financial Institutions,
Insurance Companies
and Securities/Brokerage
Firms

Financialinstitutions

2 trillion yen or

holding customers(As defined by US FSISAC)

more

financial assets
Excluded from theabove

100 billion yen

Processors and Utilities

or moreArticle 27 (Scope of Information Sharing with Holding Companies(*1))
1 Where a member is a holding company, that member may designate a major financial subsidiary interms of security management and for free be admitted as a member of ISAC. In this case the membershipcategory of the subsidiary shall be that of the holding company.
2 Where a member has a holding company as its parent company, that holding company may for free beadmitted as a member of ISAC. In this case the membership category of the holding company shall be thatof the subsidiary.
3 Paragraphs 1 and 2 of this Article shall not be simultaneously applied.

Enacted: September 19, 2014
General Incorporated Association Financials ISAC Japan(*1) “Holding Company” is defined as a holding company that has been granted a license from the Financial
Services Agency, a designated parent company, or a company where either 90% or more of sales or assets
are accounted for by financial activities.

≪Revision History≫
March 28, 2018
To footnote *1 added “a company where either 90% or more of sales or assets are accounted for by financial
activities”.
End